From 0eb8ab30508ba37bbab0a57f35fc9663336effc7 Mon Sep 17 00:00:00 2001 From: Maximilian Tagher Date: Thu, 14 Jul 2016 07:56:31 -0700 Subject: [PATCH] Document recommended usage of the CSRF middleware * Closes #1246 --- yesod-core/Yesod/Core/Class/Yesod.hs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/yesod-core/Yesod/Core/Class/Yesod.hs b/yesod-core/Yesod/Core/Class/Yesod.hs index 5893e1af..4f7d71a3 100644 --- a/yesod-core/Yesod/Core/Class/Yesod.hs +++ b/yesod-core/Yesod/Core/Class/Yesod.hs @@ -454,6 +454,18 @@ csrfSetCookieMiddleware handler cookie = setCsrfCookieWithCookie cookie >> handl -- -- For details, see the "AJAX CSRF protection" section of "Yesod.Core.Handler". -- +-- You can add this chain this middleware together with other middleware like so: +-- +-- @ +-- 'yesodMiddleware' = 'defaultYesodMiddleware' . 'defaultCsrfMiddleware' +-- @ +-- +-- or: +-- +-- @ +-- 'yesodMiddleware' app = 'defaultYesodMiddleware' $ 'defaultCsrfMiddleware' $ app +-- @ +-- -- Since 1.4.14 defaultCsrfMiddleware :: Yesod site => HandlerT site IO res -> HandlerT site IO res defaultCsrfMiddleware = defaultCsrfSetCookieMiddleware . defaultCsrfCheckMiddleware